PT-2020-12546 · Indy · Indy Node

Published 2020-06-11 · Updated 2020-06-22 · CVE-2020-11090

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Indy Node versions 1.12.2

Description The issue is related to an Uncontrolled Resource Consumption vulnerability in Indy Node's TAA handling code. A malformed transaction from a client can crash the current primary, leading to a view change. Repeated rapid view changes have the potential to bring down the network. The problem was discovered after reports of StagingNet losing sufficient consensus to validate write transactions, and it appears to be caused by someone sending a malformed transaction and retrying when the transaction fails.

Recommendations For Indy Node version 1.12.2, update to version 1.12.3 to fix the issue. As a temporary workaround, consider restricting the handling of malformed transactions to minimize the risk of exploitation. Additionally, improving the testing strategy on Indy Node can help reduce the probability of such bugs in the future.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-11090

GHSA-3GW4-M5W7-V89C

PYSEC-2020-47

Affected Products

Indy Node

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2020-11090 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-47 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3gw4-m5w7-v89c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11090 · Vendor Advisory
• https://github.com/hyperledger/indy-node/blob/master/CHANGELOG.md#1123 · Note
• https://github.com/hyperledger/indy-node/security/advisories/GHSA-3gw4-m5w7-v89c · Note
• https://github.com/hyperledger/indy-node · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/indy-node/PYSEC-2020-47.yaml · Note
• https://t.me/cvenotify/4295 · Telegram Post
• https://pypi.org/project/indy-node/1.12.3 · Note